2026-09-08_e6788a9806d95b2d32a7f56c945658cf_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_e6788a9806d95b2d32a7f56c945658cf_cobalt-strike_icedid_njrat_vidar
Size 2.2MB
Sample260910-chabcstdkf
SHA256 8a7427aec158af5a27bfa9eb4c71fa2895cbdd9d168c9b41d1955f83861da974
MD5 e6788a9806d95b2d32a7f56c945658cf
SHA1 bcd59015da1357ae160f5448f113bd6ec0edc65d
SHA512 1cfe9acea76026532ec95f302f6b5fdd40e88638310a71cf2b88adbc1bfcffd713b1e68e22cef89b4cf1a02b1f21063f3ec66c571b85fb2c24fcaf3245d527ff
SSDEEP 24576:3kMPewiyYaquyd0cimETAFKSyneWsqjnhMgeiCl7G0nehbGZpbD:0MPewiKqufmE4KZPDmg27RnWGj
TLSH
T189A5BE1AF3DC0189E1B7927D89964B49E672F805033197CF01A446DE2F27BE94E3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_e6788a9806d95b2d32a7f56c945658cf_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-09-08_e6788a9806d95b2d32a7f56c945658cf_cobalt-strike_icedid_njrat_vidar

.exe 2.2MB

2026-09-08_e6788a9806d95b2d32a7f56c945658cf_cobalt-strike_icedid_njrat_vidar

IMPHASH e9390588d542ddec04ab6acee3ed5c29
SHA256 8a7427aec158af5a27bfa9eb4c71fa2895cbdd9d168c9b41d1955f83861da974
MD5 e6788a9806d95b2d32a7f56c945658cf
SHA1 bcd59015da1357ae160f5448f113bd6ec0edc65d
SHA512 1cfe9acea76026532ec95f302f6b5fdd40e88638310a71cf2b88adbc1bfcffd713b1e68e22cef89b4cf1a02b1f21063f3ec66c571b85fb2c24fcaf3245d527ff
SSDEEP 24576:3kMPewiyYaquyd0cimETAFKSyneWsqjnhMgeiCl7G0nehbGZpbD:0MPewiKqufmE4KZPDmg27RnWGj
TLSH
T189A5BE1AF3DC0189E1B7927D89964B49E672F805033197CF01A446DE2F27BE94E3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\home\jenkins\agent\workspace\AMING_Driver-ITS_release-jenkins\Release\bin\x64\Release\LNBITSSvc.pdb

kernel32

LoadLibraryW SetLastError DeviceIoControl HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FreeLibrary WideCharToMultiByte LocalFree GetTickCount64 GetModuleFileNameW CopyFileW DeleteFileW MoveFileExW SetEndOfFile SetStdHandle SetEnvironmentVariableW GetSystemDirectoryW WaitForMultipleObjects Sleep OpenEventW CreateEventW ResetEvent SetEvent CreateFileW K32GetModuleFileNameExW K32EnumProcesses Process32NextW Process32FirstW CreateToolhelp32Snapshot WTSGetActiveConsoleSessionId QueryFullProcessImageNameW LoadLibraryExW GetProcAddress ReadProcessMemory OpenProcess ProcessIdToSessionId CreateProcessW GetCurrentProcessId GetCurrentProcess WaitForSingleObject CloseHandle DeleteCriticalSection InitializeCriticalSectionEx GetLastError OpenMutexW DecodePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx SetConsoleCtrlHandler GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCurrentThread GetCommandLineW GetCommandLineA WriteFile ExitProcess WriteConsoleW GetFileType GetStdHandle ReadFile GetFileAttributesExW CreateDirectoryW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext MultiByteToWideChar IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection FormatMessageA GetStringTypeW WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetLocaleInfoEx EncodePointer LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW CompareStringEx GetCPInfo InitializeSListHead

user32

UnregisterClassW

advapi32

RegQueryInfoKeyW RegEnumKeyExW StartServiceW QueryServiceStatusEx OpenServiceW OpenSCManagerW EnumDependentServicesW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W RegDeleteTreeW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegNotifyChangeKeyValue RegCreateKeyExW RegCloseKey LookupPrivilegeValueW SetTokenInformation GetTokenInformation DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoInitializeSecurity CoInitializeEx CoCreateInstance CoSetProxyBlanket StringFromGUID2 CoUninitialize

oleaut32

SetErrorInfo VariantChangeType GetErrorInfo CreateErrorInfo SysStringByteLen SysAllocString BSTR_UserUnmarshal SysFreeString VariantClear VariantInit VariantCopy VarBstrCmp BSTR_UserFree LPSAFEARRAY_UserSize LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserUnmarshal LPSAFEARRAY_UserFree SysAllocStringByteLen BSTR_UserSize SafeArrayUnaccessData BSTR_UserMarshal SafeArrayAccessData

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken

rpcrt4

NdrServerCall2 RpcStringFreeW RpcStringBindingComposeW RpcBindingFromStringBindingW RpcBindingFree NdrClientCall2

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInfo SetupDiGetClassDevsW CM_Get_DevNode_Status SetupDiGetClassDescriptionW SetupDiCallClassInstaller SetupDiRemoveDevice SetupDiGetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification PowerSettingRegisterNotification PowerGetActiveScheme

dbghelp

MakeSureDirectoryPathExists

winmm

timeKillEvent timeSetEvent

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1024B

Virtual Size

863B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_e6788a9806d95b2d32a7f56c945658cf_cobalt-strike_icedid_njrat_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

userenv

wtsapi32

rpcrt4

setupapi

api-ms-win-power-setting-l1-1-0

dbghelp

winmm

generic